3Com 3C16111 - SuperStack 3 Firewall Web Site Filter, User Manual

Page: 159 / 214

Using Network Access Policy Rules 159
When evaluating rules, the Firewall uses the following criteria:
■
A rule defining a specific service is more specific than the default rule.
■
A defined Ethernet link, such as LAN, WAN, or DMZ, is more specific
than
* (all).
■
A single IP address is more specific than an IP address range.
Rules are listed in the Web interface from most specific to the least
specific, and rules at the top override rules listed below.
Examples of Network
Access Policies
The following examples illustrate methods for creating Network Access
Policy Rules.
Blocking LAN Access to Specific Protocols
This example shows how to block all LAN access to NNTP servers on the
Internet.
1 For the Action, choose Deny .
2 From the Service list, choose NNTP.
If the service is not listed in the menu, add it in the Add Service window.
3 Select LAN from the Source Ethernet list.
4 Since all computers on the LAN are to be affected, enter
*
in the Source
Addr. Range Begin box.
5 Select WAN from the Destination Ethernet menu.
6 Since the intent is to block access to all NNTP servers, enter
*
in the
Destination Addr. Range Begin box.
7 Click Add Rule .
Block Access to Specific Users
This example shows how to create a rule which blocks a certain range of
computers, such as a competitor, from accessing the public Web server
on the LAN or DMZ.
1 For the Action, choose Deny .
2 From the Service list, choose HTTP .
3 Select WAN from the Source Ethernet list.
DUA1611-0AAA02.book Page 159 Thursday, August 2, 2001 4:01 PM